It is a CHR in a virtual lab I set in Pnetlab
Is the intervlan routing happening on the OPNsense device?
And are devices connected to ether1 (vlan 10) getting a different dhcp address than for ether3 (vlan 20) or ether5 (vlan 30)?
Yes, everything works fine as long as the bridge is tagged along with Ether7 as you can see in my setup above
The reason I ask is that once you add the vlans to the BR1 device, then you have connected the vlans to the MikroTik router.
If intervlan routing is occurring on the MikroTik, then yes, you need to add the vlans to BR1 (since that is the “connection” to the MicroTik router). And the > excellent explanation > by @sindy is well worth reading in any case.
There is no MK router; the chr is set as a simple switch. The Vlans are managed by the OPnsense firewall
…
If you disconnect the trunk connection to ether7 of the MikroTik device, then connect PC’s to the MikroTik device’s ether1 and ether2, do they still get an ip address via dhcp (if they do, they aren’t getting them from the OPNsense device). But even without a trunk connection, they will probably get an APIPA (169.254.x.x) address.
No, of course. The dhcp servers are running in OPnsense.
and change
add bridge=BR1 tagged=ether7> ,BR1 > untagged=ether1,ether2 vlan-ids=10
to
add bridge=BR1 tagged=ether7 untagged=ether1,ether2 vlan-ids=10i would expect that the two PCs connected to ether1 and ether2 would be able to communicate at layer 2. i.e. it PC based firewall doesn’t prevent it, you should be able to ping the other PC (get the ip address with ipconfig from a cmd prompt).
If you go back to your original config where BR1 didn’t have a tagged connmove one of the PC’s to ether3, you shouldn’t be able to have any communication between the PC’s because they are on different vlans, and And even if you remove the tagged BR1 from all the vlans, as long as you still have ether7 as tagged, it should allow the tagged traffic to reach the trunk port on the OPNsense device.
What are the symptoms you are seeing?
If I remove BR1 as a tagged port and restart the switch, I can’t even get access to it via the management port Ether8 (which is not part of the bridge BR1) via Winbox from my PC anymore.
Here is the topology to make it clearer:
Thank you very much